velocious 1.0.504 → 1.0.506

package/build/src/sync/sync-websocket-channel.js

@@ -120,12 +120,83 @@ export default class SyncWebsocketChannel extends VelociousWebsocketChannel {
         }
         return true;
     }
+    /**
+     * Delivers a matched broadcast. Scoped subscriptions (with explicit
+     * conditions) already routed through {@link SyncWebsocketChannel#matches}, so
+     * the change is in scope and delivers unchanged. User-scope subscriptions
+     * (empty conditions, "everything my ability can see") match every broadcast
+     * of the resource type, so each published change is re-checked against the
+     * subscriber's ability at fan-out through the app sync resource's
+     * `changeDeliverable`; only accessible changes are delivered, and a broadcast
+     * with no accessible change is dropped.
+     * @param {import("../http-server/websocket-channel.js").WebsocketJsonValue} body - Broadcast body (sync envelope).
+     * @param {{eventId?: string}} [meta] - Optional event metadata.
+     * @returns {Promise<void>}
+     */
+    async deliverBroadcast(body, meta) {
+        if (!this._isUserScope()) {
+            this.sendMessage(body, meta);
+            return;
+        }
+        const deliverableBody = await this._userScopeDeliverableBody(body);
+        if (deliverableBody !== null)
+            this.sendMessage(deliverableBody, meta);
+    }
+    /**
+     * Whether this subscription is a user scope: authorized with empty conditions
+     * ("everything my ability can see").
+     * @returns {boolean} Whether the subscription is a user scope.
+     */
+    _isUserScope() {
+        return Boolean(this._scope) && Object.keys(/** @type {import("./sync-resource-base.js").SerializedChangesScope} */ (this._scope).conditions).length === 0;
+    }
+    /**
+     * Filters a user-scope broadcast to the sync entries the subscriber's ability
+     * can access, re-checking each through the app sync resource's
+     * `changeDeliverable`. Returns the broadcast narrowed to accessible entries,
+     * or null when none are accessible. Non-envelope bodies and entries without a
+     * resource id are dropped (fail closed).
+     * @param {import("../http-server/websocket-channel.js").WebsocketJsonValue} body - Broadcast body.
+     * @returns {Promise<import("../http-server/websocket-channel.js").WebsocketJsonValue | null>} Deliverable body, or null.
+     */
+    async _userScopeDeliverableBody(body) {
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            return null;
+        const envelope = /** @type {Record<string, ?>} */ (body);
+        const scope = /** @type {import("./sync-resource-base.js").SerializedChangesScope} */ (this._scope);
+        const syncs = Array.isArray(envelope.syncs) ? envelope.syncs : [envelope];
+        const configuration = this.session.configuration;
+        /** @type {Array<Record<string, ?>>} */
+        const deliverableSyncs = [];
+        // Broadcast fan-out runs through `withoutCurrentConnectionContexts` (see
+        // Configuration#_broadcastToChannelLocal), so there is no ambient database
+        // connection here. Resolve the resource's ability and run the per-delivery
+        // access query inside a checked-out connection context, mirroring how other
+        // broadcast-time DB work (the frontend-model channel) obtains connections.
+        await configuration.ensureConnections({ name: `${VELOCIOUS_SYNC_CHANNEL} user-scope delivery access check` }, async () => {
+            const resource = await this.buildSyncResource();
+            for (const sync of syncs) {
+                const resourceId = sync?.resourceId;
+                const resourceType = sync?.resourceType ?? scope.resourceType;
+                if (resourceId === undefined || resourceId === null)
+                    continue;
+                if (await resource.changeDeliverable({ params: this.params, scope, sync: { resourceId: String(resourceId), resourceType: String(resourceType) } })) {
+                    deliverableSyncs.push(sync);
+                }
+            }
+        });
+        if (deliverableSyncs.length === 0)
+            return null;
+        if (Array.isArray(envelope.syncs))
+            return { ...envelope, syncs: deliverableSyncs };
+        return deliverableSyncs[0];
+    }
     /**
      * Returns the authorized scope for debug snapshots.
      * @returns {Record<string, ?>} Debug-safe subscription details.
      */
     debugSnapshot() {
-        return { scope: this._scope };
+        return { scope: this._scope, userScope: this._isUserScope() };
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3luYy13ZWJzb2NrZXQtY2hhbm5lbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zeW5jL3N5bmMtd2Vic29ja2V0LWNoYW5uZWwuanMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsWUFBWTtBQUVaLE9BQU8seUJBQXlCLE1BQU0scUNBQXFDLENBQUE7QUFDM0UsT0FBTyxFQUFDLHNCQUFzQixFQUFDLE1BQU0sd0JBQXdCLENBQUE7QUFFN0QsK0VBQStFO0FBQy9FLE1BQU0sd0JBQXdCLEdBQUcsSUFBSSxPQUFPLEVBQUUsQ0FBQTtBQUU5Qzs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sQ0FBQyxPQUFPLE9BQU8sb0JBQXFCLFNBQVEseUJBQXlCO0lBQ3pFOzs7T0FHRztJQUNILE1BQU0sR0FBRyxJQUFJLENBQUE7SUFFYjs7Ozs7OztPQU9HO0lBQ0gsTUFBTSxDQUFDLHlCQUF5QixDQUFDLGFBQWE7UUFDNUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEdBQUcsSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDO1lBQUUsT0FBTTtRQUVwRyx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUE7UUFDM0MsYUFBYSxDQUFDLHdCQUF3QixDQUFDLHNCQUFzQixFQUFFLElBQUksQ0FBQyxDQUFBO0lBQ3RFLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxLQUFLLENBQUMsWUFBWTtRQUNoQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFBO1FBQy9DLE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxZQUFZLENBQUMsRUFBQyxLQUFLLEVBQUUsRUFBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFDLEVBQUMsQ0FBQyxDQUFBO1FBRTFILE1BQU0sUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFDLENBQUMsQ0FBQTtRQUU3RCxJQUFJLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQTtRQUVuQixPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxLQUFLLENBQUMsaUJBQWlCO1FBQ3JCLE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFBO1FBQ2hELE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEdBQUcsQ0FBQTtRQUVwRCxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDVCxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sc0JBQXNCLHFGQUFxRixDQUFDLENBQUE7UUFDckksQ0FBQztRQUVELHNFQUFzRTtRQUN0RSxvRUFBb0U7UUFDcEUsTUFBTSxhQUFhLEdBQUcsK0RBQStELENBQUMsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUE7UUFDekcsMEVBQTBFO1FBQzFFLE1BQU0sTUFBTSxHQUFHLGtFQUFrRSxDQUFDLEVBQUMsc0JBQXVCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUE7UUFDeEgsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUE7UUFDM0MsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUMsY0FBYyxDQUFDLEVBQUMsTUFBTSxFQUFFLE9BQU8sRUFBQyxDQUFDLENBQUE7UUFFckUsT0FBTyxJQUFJLGFBQWEsQ0FBQztZQUN2QixPQUFPO1lBQ1AsT0FBTyxFQUFFO2dCQUNQLEdBQUcsQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxDQUFDO2dCQUNoQyxNQUFNO2dCQUNOLE9BQU87YUFDUjtZQUNELE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRTtZQUNsQyxVQUFVLEVBQUUsYUFBYSxDQUFDLFVBQVU7WUFDcEMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxVQUFVLEVBQUUsSUFBSTtZQUN6QyxNQUFNO1lBQ04scUJBQXFCLEVBQUUscUZBQXFGLENBQUMsQ0FBQztnQkFDNUcsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVLElBQUksRUFBRTtnQkFDMUMsSUFBSSxFQUFFLEVBQUMsT0FBTyxFQUFFLElBQUksRUFBQzthQUN0QixDQUFDO1NBQ0gsQ0FBQyxDQUFBO0lBQ0osQ0FBQztJQUVEOzs7Ozs7Ozs7O09BVUc7SUFDSCxPQUFPLENBQUMsZUFBZTtRQUNyQixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFBO1FBRXpCLElBQUksQ0FBQyxLQUFLO1lBQUUsT0FBTyxLQUFLLENBQUE7UUFFeEIsTUFBTSxhQUFhLEdBQUcsZUFBZSxJQUFJLE9BQU8sZUFBZSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO1lBQzdHLENBQUMsQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDLGVBQWUsQ0FBQztZQUNwRCxDQUFDLENBQUMsRUFBRSxDQUFBO1FBRU4sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUVwSSxLQUFLLE1BQU0sQ0FBQyxhQUFhLEVBQUUsY0FBYyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUMvRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsYUFBYSxDQUFDO2dCQUFFLE9BQU8sS0FBSyxDQUFBO1lBRTlELE1BQU0sWUFBWSxHQUFHLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FBQTtZQUVqRCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztnQkFDbEMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7b0JBQUUsT0FBTyxLQUFLLENBQUE7WUFDM0YsQ0FBQztpQkFBTSxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsS0FBSyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztnQkFDM0QsT0FBTyxLQUFLLENBQUE7WUFDZCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUVEOzs7T0FHRztJQUNILGFBQWE7UUFDWCxPQUFPLEVBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUMsQ0FBQTtJQUM3QixDQUFDO0NBQ0YiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBAdHMtY2hlY2tcblxuaW1wb3J0IFZlbG9jaW91c1dlYnNvY2tldENoYW5uZWwgZnJvbSBcIi4uL2h0dHAtc2VydmVyL3dlYnNvY2tldC1jaGFubmVsLmpzXCJcbmltcG9ydCB7VkVMT0NJT1VTX1NZTkNfQ0hBTk5FTH0gZnJvbSBcIi4vc3luYy1jaGFubmVsLW5hbWUuanNcIlxuXG4vKiogQ29uZmlndXJhdGlvbnMgd2hvc2UgZnJhbWV3b3JrIHN5bmMgY2hhbm5lbCBoYXMgYWxyZWFkeSBiZWVuIHJlZ2lzdGVyZWQuICovXG5jb25zdCByZWdpc3RlcmVkQ29uZmlndXJhdGlvbnMgPSBuZXcgV2Vha1NldCgpXG5cbi8qKlxuICogRnJhbWV3b3JrLW93bmVkIHdlYnNvY2tldCBjaGFubmVsIGZvciBzeW5jZWQgcmVzb3VyY2VzXG4gKiAoe0BsaW5rIFZFTE9DSU9VU19TWU5DX0NIQU5ORUx9KS5cbiAqXG4gKiBTdWJzY3JpYmUgcGFyYW1zIG1pcnJvciBhIGRlY2xhcmVkIHB1bGwgc2NvcGUg4oCUIGB7cmVzb3VyY2VUeXBlLCBjb25kaXRpb25zfWBcbiAqIHBsdXMgdGhlIGNsaWVudC1pbmplY3RlZCBgYXV0aGVudGljYXRpb25Ub2tlbmAg4oCUIGFuZCBzdWJzY3JpYmUtdGltZVxuICogYXV0aG9yaXphdGlvbiBkZWxlZ2F0ZXMgdG8gdGhlIGFwcCBzeW5jIHJlc291cmNlJ3MgZXhpc3RpbmdcbiAqIGBhdXRob3JpemVDaGFuZ2VzKHtwYXJhbXMsIHNjb3BlfSlgICh0aGUgYHN5bmMuYXBpLnJlc291cmNlQ2xhc3NgKSwgc28gYXBwc1xuICogaG9vayBpbiB0aHJvdWdoIHRoZSBhdXRob3JpemF0aW9uIHRoZXkgYWxyZWFkeSBkZWNsYXJlZCBpbnN0ZWFkIG9mIHdyaXRpbmdcbiAqIHRoZWlyIG93biBjaGFubmVsIGNsYXNzZXMuIEJyb2FkY2FzdCByb3V0aW5nIG1hdGNoZXMgdGhlIHB1Ymxpc2hlcidzXG4gKiBzY29waW5nIHBhcmFtcyBhZ2FpbnN0IHRoZSBzdWJzY3JpcHRpb24ncyBzY29wZSBjb25kaXRpb25zLlxuICovXG5leHBvcnQgZGVmYXVsdCBjbGFzcyBTeW5jV2Vic29ja2V0Q2hhbm5lbCBleHRlbmRzIFZlbG9jaW91c1dlYnNvY2tldENoYW5uZWwge1xuICAvKipcbiAgICogU2NvcGUgdGhlIHN1YnNjcmlwdGlvbiB3YXMgYXV0aG9yaXplZCBmb3IsIHNldCBieSB7QGxpbmsgU3luY1dlYnNvY2tldENoYW5uZWwjY2FuU3Vic2NyaWJlfS5cbiAgICogQHR5cGUge2ltcG9ydChcIi4vc3luYy1yZXNvdXJjZS1iYXNlLmpzXCIpLlNlcmlhbGl6ZWRDaGFuZ2VzU2NvcGUgfCBudWxsfVxuICAgKi9cbiAgX3Njb3BlID0gbnVsbFxuXG4gIC8qKlxuICAgKiBSZWdpc3RlcnMgdGhlIGZyYW1ld29yayBzeW5jIGNoYW5uZWwgb24gYSBjb25maWd1cmF0aW9uIGRlY2xhcmluZyBhXG4gICAqIGBzeW5jLmFwaWAgYmxvY2sgKGd1YXJkZWQgc28gcmVwZWF0ZWQgc2VydmVyIGJvb3RzIHdpdGggdGhlIHNhbWVcbiAgICogY29uZmlndXJhdGlvbiByZWdpc3RlciBpdCBvbmx5IG9uY2UpLiBOby1vcCB3aXRob3V0IGBzeW5jLmFwaWAg4oCUIHRoZVxuICAgKiBjaGFubmVsIGF1dGhvcml6ZXMgdGhyb3VnaCB0aGUgYXBwJ3Mgc3luYyByZXNvdXJjZSBjbGFzcy5cbiAgICogQHBhcmFtIHtpbXBvcnQoXCIuLi9jb25maWd1cmF0aW9uLmpzXCIpLmRlZmF1bHR9IGNvbmZpZ3VyYXRpb24gLSBDb25maWd1cmF0aW9uIGluc3RhbmNlLlxuICAgKiBAcmV0dXJucyB7dm9pZH1cbiAgICovXG4gIHN0YXRpYyByZWdpc3RlckZyb21Db25maWd1cmF0aW9uKGNvbmZpZ3VyYXRpb24pIHtcbiAgICBpZiAoIWNvbmZpZ3VyYXRpb24uZ2V0U3luY0NvbmZpZ3VyYXRpb24oKS5hcGkgfHwgcmVnaXN0ZXJlZENvbmZpZ3VyYXRpb25zLmhhcyhjb25maWd1cmF0aW9uKSkgcmV0dXJuXG5cbiAgICByZWdpc3RlcmVkQ29uZmlndXJhdGlvbnMuYWRkKGNvbmZpZ3VyYXRpb24pXG4gICAgY29uZmlndXJhdGlvbi5yZWdpc3RlcldlYnNvY2tldENoYW5uZWwoVkVMT0NJT1VTX1NZTkNfQ0hBTk5FTCwgdGhpcylcbiAgfVxuXG4gIC8qKlxuICAgKiBBdXRob3JpemVzIHRoZSBzdWJzY3JpcHRpb24gdGhyb3VnaCB0aGUgYXBwIHN5bmMgcmVzb3VyY2U6IHRoZSBzdWJzY3JpYmVcbiAgICogcGFyYW1zIGFyZSBwYXJzZWQgaW50byB0aGUgc2FtZSBzZXJpYWxpemVkIHNjb3BlIHRoZSBjaGFuZ2VzIGVuZHBvaW50XG4gICAqIGNvbnN1bWVzIGFuZCBwYXNzZWQgdG8gdGhlIHJlc291cmNlJ3MgYGF1dGhvcml6ZUNoYW5nZXMoe3BhcmFtcywgc2NvcGV9KWAuXG4gICAqIERlbmlhbHMgYW5kIG1hbGZvcm1lZCBzY29wZXMgdGhyb3csIHJlamVjdGluZyB0aGUgc3Vic2NyaXB0aW9uLlxuICAgKiBAcmV0dXJucyB7UHJvbWlzZTxib29sZWFuPn0gV2hldGhlciB0aGUgc3Vic2NyaXB0aW9uIGlzIGFsbG93ZWQuXG4gICAqL1xuICBhc3luYyBjYW5TdWJzY3JpYmUoKSB7XG4gICAgY29uc3QgcmVzb3VyY2UgPSBhd2FpdCB0aGlzLmJ1aWxkU3luY1Jlc291cmNlKClcbiAgICBjb25zdCBzY29wZSA9IHJlc291cmNlLmNoYW5nZXNTY29wZSh7c2NvcGU6IHtjb25kaXRpb25zOiB0aGlzLnBhcmFtcy5jb25kaXRpb25zLCByZXNvdXJjZVR5cGU6IHRoaXMucGFyYW1zLnJlc291cmNlVHlwZX19KVxuXG4gICAgYXdhaXQgcmVzb3VyY2UuYXV0aG9yaXplQ2hhbmdlcyh7cGFyYW1zOiB0aGlzLnBhcmFtcywgc2NvcGV9KVxuXG4gICAgdGhpcy5fc2NvcGUgPSBzY29wZVxuXG4gICAgcmV0dXJuIHRydWVcbiAgfVxuXG4gIC8qKlxuICAgKiBCdWlsZHMgdGhlIGFwcCBzeW5jIHJlc291cmNlIGF1dGhvcml6aW5nIHRoaXMgc3Vic2NyaXB0aW9uLCBtaXJyb3JpbmcgdGhlXG4gICAqIHN5bmMgdHJhbnNwb3J0IGNvbnRyb2xsZXIncyByZXNvdXJjZSBjb25zdHJ1Y3Rpb24gd2l0aCB0aGUgYWJpbGl0eVxuICAgKiByZXNvbHZlZCBmcm9tIHRoZSBzdWJzY3JpYmUgcGFyYW1zICh3aGljaCBjYXJyeSB0aGUgY2xpZW50LWluamVjdGVkXG4gICAqIGF1dGhlbnRpY2F0aW9uVG9rZW4pLlxuICAgKiBAcmV0dXJucyB7UHJvbWlzZTxpbXBvcnQoXCIuL3N5bmMtcmVzb3VyY2UtYmFzZS5qc1wiKS5kZWZhdWx0Pn0gQXBwIHN5bmMgcmVzb3VyY2UgaW5zdGFuY2UuXG4gICAqL1xuICBhc3luYyBidWlsZFN5bmNSZXNvdXJjZSgpIHtcbiAgICBjb25zdCBjb25maWd1cmF0aW9uID0gdGhpcy5zZXNzaW9uLmNvbmZpZ3VyYXRpb25cbiAgICBjb25zdCBhcGkgPSBjb25maWd1cmF0aW9uLmdldFN5bmNDb25maWd1cmF0aW9uKCkuYXBpXG5cbiAgICBpZiAoIWFwaSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBUaGUgJHtWRUxPQ0lPVVNfU1lOQ19DSEFOTkVMfSBjaGFubmVsIHJlcXVpcmVzIGEgc3luYy5hcGkgY29uZmlndXJhdGlvbiBibG9jayB3aXRoIHRoZSBhcHAncyBzeW5jIHJlc291cmNlIGNsYXNzYClcbiAgICB9XG5cbiAgICAvLyBOYXJyb3dzIHRoZSBjb25maWd1cmVkIHJlc291cmNlIGNsYXNzIHRvIHRoZSBzeW5jIHJlc291cmNlIGNvbnRyYWN0XG4gICAgLy8gKGNoYW5nZXNTY29wZS9hdXRob3JpemVDaGFuZ2VzKSB0aGUgc3luYy5hcGkgdmFsaWRhdGlvbiByZXF1aXJlcy5cbiAgICBjb25zdCBSZXNvdXJjZUNsYXNzID0gLyoqIEB0eXBlIHt0eXBlb2YgaW1wb3J0KFwiLi9zeW5jLXJlc291cmNlLWJhc2UuanNcIikuZGVmYXVsdH0gKi8gKGFwaS5yZXNvdXJjZUNsYXNzKVxuICAgIC8vIE5hcnJvd3MgdGhlIHdlYnNvY2tldCBzdWJzY3JpYmUgcGFyYW1zIHRvIHRoZSByZXNvdXJjZSBwYXJhbXMgY29udHJhY3QuXG4gICAgY29uc3QgcGFyYW1zID0gLyoqIEB0eXBlIHtpbXBvcnQoXCIuLi9jb25maWd1cmF0aW9uLXR5cGVzLmpzXCIpLlZlbG9jaW91c1BhcmFtc30gKi8gKC8qKiBAdHlwZSB7dW5rbm93bn0gKi8gKHRoaXMucGFyYW1zKSlcbiAgICBjb25zdCByZXF1ZXN0ID0gdGhpcy5zZXNzaW9uLnVwZ3JhZGVSZXF1ZXN0XG4gICAgY29uc3QgYWJpbGl0eSA9IGF3YWl0IGNvbmZpZ3VyYXRpb24ucmVzb2x2ZUFiaWxpdHkoe3BhcmFtcywgcmVxdWVzdH0pXG5cbiAgICByZXR1cm4gbmV3IFJlc291cmNlQ2xhc3Moe1xuICAgICAgYWJpbGl0eSxcbiAgICAgIGNvbnRleHQ6IHtcbiAgICAgICAgLi4uKGFiaWxpdHk/LmdldENvbnRleHQoKSB8fCB7fSksXG4gICAgICAgIHBhcmFtcyxcbiAgICAgICAgcmVxdWVzdFxuICAgICAgfSxcbiAgICAgIGxvY2FsczogYWJpbGl0eT8uZ2V0TG9jYWxzKCkgfHwge30sXG4gICAgICBtb2RlbENsYXNzOiBSZXNvdXJjZUNsYXNzLk1vZGVsQ2xhc3MsXG4gICAgICBtb2RlbE5hbWU6IFJlc291cmNlQ2xhc3MuTW9kZWxDbGFzcz8ubmFtZSxcbiAgICAgIHBhcmFtcyxcbiAgICAgIHJlc291cmNlQ29uZmlndXJhdGlvbjogLyoqIEB0eXBlIHtpbXBvcnQoXCIuLi9jb25maWd1cmF0aW9uLXR5cGVzLmpzXCIpLkZyb250ZW5kTW9kZWxSZXNvdXJjZUNvbmZpZ3VyYXRpb259ICovICh7XG4gICAgICAgIGF0dHJpYnV0ZXM6IFJlc291cmNlQ2xhc3MuYXR0cmlidXRlcyB8fCB7fSxcbiAgICAgICAgc3luYzoge2VuYWJsZWQ6IHRydWV9XG4gICAgICB9KVxuICAgIH0pXG4gIH1cblxuICAvKipcbiAgICogUm91dGVzIGEgcHVibGlzaGVyIGJyb2FkY2FzdCB0byB0aGlzIHN1YnNjcmlwdGlvbiB3aGVuIHRoZSBwdWJsaXNoZWRcbiAgICogcmVzb3VyY2UgdHlwZSBlcXVhbHMgdGhlIHR5cGUgdGhlIHN1YnNjcmlwdGlvbiB3YXMgYXV0aG9yaXplZCBmb3IgYW5kIHRoZVxuICAgKiBzY29waW5nIHBhcmFtcyBzYXRpc2Z5IGV2ZXJ5IHNjb3BlIGNvbmRpdGlvbjogZWFjaCBjb25kaXRpb24ga2V5IG11c3QgYmVcbiAgICogcHJlc2VudCBpbiB0aGUgYnJvYWRjYXN0IHBhcmFtcyBhbmQgbWF0Y2ggYnkgc3RyaW5nIGNvbXBhcmlzb24gKGFycmF5XG4gICAqIGNvbmRpdGlvbnMgbWF0Y2ggYnkgbWVtYmVyc2hpcCkuIEJyb2FkY2FzdHMgd2l0aG91dCBhIHJlc291cmNlIHR5cGUgYW5kXG4gICAqIGNvbmRpdGlvbnMgdGhlIHB1Ymxpc2hlcidzIHNjb3BpbmcgcGFyYW1zIGRvIG5vdCBjYXJyeSBuZXZlciBtYXRjaCwgc28gYVxuICAgKiBzdWJzY3JpcHRpb24gY2Fubm90IHJlY2VpdmUgY2hhbmdlcyBvdXRzaWRlIGl0cyBhdXRob3JpemVkIHNjb3BlLlxuICAgKiBAcGFyYW0ge2ltcG9ydChcIi4uL2h0dHAtc2VydmVyL3dlYnNvY2tldC1jaGFubmVsLmpzXCIpLldlYnNvY2tldEpzb25WYWx1ZX0gYnJvYWRjYXN0UGFyYW1zIC0gUHVibGlzaGVyIHNjb3BpbmcgcGFyYW1zICh0aGUgcHVibGlzaGVkIHJlc291cmNlVHlwZSBwbHVzIHRoZSBjaGFuZ2UncyBzY29wZS1wYXJ0aXRpb24gdmFsdWVzKS5cbiAgICogQHJldHVybnMge2Jvb2xlYW59IFdoZXRoZXIgdGhlIGJyb2FkY2FzdCBiZWxvbmdzIHRvIHRoaXMgc3Vic2NyaXB0aW9uJ3Mgc2NvcGUuXG4gICAqL1xuICBtYXRjaGVzKGJyb2FkY2FzdFBhcmFtcykge1xuICAgIGNvbnN0IHNjb3BlID0gdGhpcy5fc2NvcGVcblxuICAgIGlmICghc2NvcGUpIHJldHVybiBmYWxzZVxuXG4gICAgY29uc3Qgc2NvcGluZ1BhcmFtcyA9IGJyb2FkY2FzdFBhcmFtcyAmJiB0eXBlb2YgYnJvYWRjYXN0UGFyYW1zID09PSBcIm9iamVjdFwiICYmICFBcnJheS5pc0FycmF5KGJyb2FkY2FzdFBhcmFtcylcbiAgICAgID8gLyoqIEB0eXBlIHtSZWNvcmQ8c3RyaW5nLCA/Pn0gKi8gKGJyb2FkY2FzdFBhcmFtcylcbiAgICAgIDoge31cblxuICAgIGlmICghT2JqZWN0Lmhhc093bihzY29waW5nUGFyYW1zLCBcInJlc291cmNlVHlwZVwiKSB8fCBTdHJpbmcoc2NvcGluZ1BhcmFtcy5yZXNvdXJjZVR5cGUpICE9PSBTdHJpbmcoc2NvcGUucmVzb3VyY2VUeXBlKSkgcmV0dXJuIGZhbHNlXG5cbiAgICBmb3IgKGNvbnN0IFtjb25kaXRpb25OYW1lLCBjb25kaXRpb25WYWx1ZV0gb2YgT2JqZWN0LmVudHJpZXMoc2NvcGUuY29uZGl0aW9ucykpIHtcbiAgICAgIGlmICghT2JqZWN0Lmhhc093bihzY29waW5nUGFyYW1zLCBjb25kaXRpb25OYW1lKSkgcmV0dXJuIGZhbHNlXG5cbiAgICAgIGNvbnN0IHNjb3BpbmdWYWx1ZSA9IHNjb3BpbmdQYXJhbXNbY29uZGl0aW9uTmFtZV1cblxuICAgICAgaWYgKEFycmF5LmlzQXJyYXkoY29uZGl0aW9uVmFsdWUpKSB7XG4gICAgICAgIGlmICghY29uZGl0aW9uVmFsdWUuc29tZSgodmFsdWUpID0+IFN0cmluZyh2YWx1ZSkgPT09IFN0cmluZyhzY29waW5nVmFsdWUpKSkgcmV0dXJuIGZhbHNlXG4gICAgICB9IGVsc2UgaWYgKFN0cmluZyhjb25kaXRpb25WYWx1ZSkgIT09IFN0cmluZyhzY29waW5nVmFsdWUpKSB7XG4gICAgICAgIHJldHVybiBmYWxzZVxuICAgICAgfVxuICAgIH1cblxuICAgIHJldHVybiB0cnVlXG4gIH1cblxuICAvKipcbiAgICogUmV0dXJucyB0aGUgYXV0aG9yaXplZCBzY29wZSBmb3IgZGVidWcgc25hcHNob3RzLlxuICAgKiBAcmV0dXJucyB7UmVjb3JkPHN0cmluZywgPz59IERlYnVnLXNhZmUgc3Vic2NyaXB0aW9uIGRldGFpbHMuXG4gICAqL1xuICBkZWJ1Z1NuYXBzaG90KCkge1xuICAgIHJldHVybiB7c2NvcGU6IHRoaXMuX3Njb3BlfVxuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3luYy13ZWJzb2NrZXQtY2hhbm5lbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zeW5jL3N5bmMtd2Vic29ja2V0LWNoYW5uZWwuanMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsWUFBWTtBQUVaLE9BQU8seUJBQXlCLE1BQU0scUNBQXFDLENBQUE7QUFDM0UsT0FBTyxFQUFDLHNCQUFzQixFQUFDLE1BQU0sd0JBQXdCLENBQUE7QUFFN0QsK0VBQStFO0FBQy9FLE1BQU0sd0JBQXdCLEdBQUcsSUFBSSxPQUFPLEVBQUUsQ0FBQTtBQUU5Qzs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sQ0FBQyxPQUFPLE9BQU8sb0JBQXFCLFNBQVEseUJBQXlCO0lBQ3pFOzs7T0FHRztJQUNILE1BQU0sR0FBRyxJQUFJLENBQUE7SUFFYjs7Ozs7OztPQU9HO0lBQ0gsTUFBTSxDQUFDLHlCQUF5QixDQUFDLGFBQWE7UUFDNUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEdBQUcsSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDO1lBQUUsT0FBTTtRQUVwRyx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUE7UUFDM0MsYUFBYSxDQUFDLHdCQUF3QixDQUFDLHNCQUFzQixFQUFFLElBQUksQ0FBQyxDQUFBO0lBQ3RFLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxLQUFLLENBQUMsWUFBWTtRQUNoQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFBO1FBQy9DLE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxZQUFZLENBQUMsRUFBQyxLQUFLLEVBQUUsRUFBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFDLEVBQUMsQ0FBQyxDQUFBO1FBRTFILE1BQU0sUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFDLENBQUMsQ0FBQTtRQUU3RCxJQUFJLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQTtRQUVuQixPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSCxLQUFLLENBQUMsaUJBQWlCO1FBQ3JCLE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFBO1FBQ2hELE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEdBQUcsQ0FBQTtRQUVwRCxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDVCxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sc0JBQXNCLHFGQUFxRixDQUFDLENBQUE7UUFDckksQ0FBQztRQUVELHNFQUFzRTtRQUN0RSxvRUFBb0U7UUFDcEUsTUFBTSxhQUFhLEdBQUcsK0RBQStELENBQUMsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUE7UUFDekcsMEVBQTBFO1FBQzFFLE1BQU0sTUFBTSxHQUFHLGtFQUFrRSxDQUFDLEVBQUMsc0JBQXVCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUE7UUFDeEgsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUE7UUFDM0MsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUMsY0FBYyxDQUFDLEVBQUMsTUFBTSxFQUFFLE9BQU8sRUFBQyxDQUFDLENBQUE7UUFFckUsT0FBTyxJQUFJLGFBQWEsQ0FBQztZQUN2QixPQUFPO1lBQ1AsT0FBTyxFQUFFO2dCQUNQLEdBQUcsQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxDQUFDO2dCQUNoQyxNQUFNO2dCQUNOLE9BQU87YUFDUjtZQUNELE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRTtZQUNsQyxVQUFVLEVBQUUsYUFBYSxDQUFDLFVBQVU7WUFDcEMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxVQUFVLEVBQUUsSUFBSTtZQUN6QyxNQUFNO1lBQ04scUJBQXFCLEVBQUUscUZBQXFGLENBQUMsQ0FBQztnQkFDNUcsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVLElBQUksRUFBRTtnQkFDMUMsSUFBSSxFQUFFLEVBQUMsT0FBTyxFQUFFLElBQUksRUFBQzthQUN0QixDQUFDO1NBQ0gsQ0FBQyxDQUFBO0lBQ0osQ0FBQztJQUVEOzs7Ozs7Ozs7O09BVUc7SUFDSCxPQUFPLENBQUMsZUFBZTtRQUNyQixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFBO1FBRXpCLElBQUksQ0FBQyxLQUFLO1lBQUUsT0FBTyxLQUFLLENBQUE7UUFFeEIsTUFBTSxhQUFhLEdBQUcsZUFBZSxJQUFJLE9BQU8sZUFBZSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO1lBQzdHLENBQUMsQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDLGVBQWUsQ0FBQztZQUNwRCxDQUFDLENBQUMsRUFBRSxDQUFBO1FBRU4sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUVwSSxLQUFLLE1BQU0sQ0FBQyxhQUFhLEVBQUUsY0FBYyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUMvRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsYUFBYSxDQUFDO2dCQUFFLE9BQU8sS0FBSyxDQUFBO1lBRTlELE1BQU0sWUFBWSxHQUFHLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FBQTtZQUVqRCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztnQkFDbEMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7b0JBQUUsT0FBTyxLQUFLLENBQUE7WUFDM0YsQ0FBQztpQkFBTSxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsS0FBSyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztnQkFDM0QsT0FBTyxLQUFLLENBQUE7WUFDZCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUVEOzs7Ozs7Ozs7Ozs7T0FZRztJQUNILEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsSUFBSTtRQUMvQixJQUFJLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUE7WUFFNUIsT0FBTTtRQUNSLENBQUM7UUFFRCxNQUFNLGVBQWUsR0FBRyxNQUFNLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsQ0FBQTtRQUVsRSxJQUFJLGVBQWUsS0FBSyxJQUFJO1lBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsSUFBSSxDQUFDLENBQUE7SUFDdkUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxZQUFZO1FBQ1YsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQTtJQUMzSixDQUFDO0lBRUQ7Ozs7Ozs7O09BUUc7SUFDSCxLQUFLLENBQUMseUJBQXlCLENBQUMsSUFBSTtRQUNsQyxJQUFJLENBQUMsSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztZQUFFLE9BQU8sSUFBSSxDQUFBO1FBRXpFLE1BQU0sUUFBUSxHQUFHLGdDQUFnQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUE7UUFDeEQsTUFBTSxLQUFLLEdBQUcsdUVBQXVFLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUE7UUFDbkcsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDekUsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUE7UUFDaEQsdUNBQXVDO1FBQ3ZDLE1BQU0sZ0JBQWdCLEdBQUcsRUFBRSxDQUFBO1FBRTNCLHlFQUF5RTtRQUN6RSwyRUFBMkU7UUFDM0UsMkVBQTJFO1FBQzNFLDRFQUE0RTtRQUM1RSwyRUFBMkU7UUFDM0UsTUFBTSxhQUFhLENBQUMsaUJBQWlCLENBQUMsRUFBQyxJQUFJLEVBQUUsR0FBRyxzQkFBc0IsbUNBQW1DLEVBQUMsRUFBRSxLQUFLLElBQUksRUFBRTtZQUNySCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFBO1lBRS9DLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sVUFBVSxHQUFHLElBQUksRUFBRSxVQUFVLENBQUE7Z0JBQ25DLE1BQU0sWUFBWSxHQUFHLElBQUksRUFBRSxZQUFZLElBQUksS0FBSyxDQUFDLFlBQVksQ0FBQTtnQkFFN0QsSUFBSSxVQUFVLEtBQUssU0FBUyxJQUFJLFVBQVUsS0FBSyxJQUFJO29CQUFFLFNBQVE7Z0JBRTdELElBQUksTUFBTSxRQUFRLENBQUMsaUJBQWlCLENBQUMsRUFBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEVBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFDLEVBQUMsQ0FBQyxFQUFFLENBQUM7b0JBQy9JLGdCQUFnQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQTtnQkFDN0IsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQTtRQUVGLElBQUksZ0JBQWdCLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQTtRQUM5QyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztZQUFFLE9BQU8sRUFBQyxHQUFHLFFBQVEsRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLEVBQUMsQ0FBQTtRQUVoRixPQUFPLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQzVCLENBQUM7SUFFRDs7O09BR0c7SUFDSCxhQUFhO1FBQ1gsT0FBTyxFQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsWUFBWSxFQUFFLEVBQUMsQ0FBQTtJQUM3RCxDQUFDO0NBQ0YiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBAdHMtY2hlY2tcblxuaW1wb3J0IFZlbG9jaW91c1dlYnNvY2tldENoYW5uZWwgZnJvbSBcIi4uL2h0dHAtc2VydmVyL3dlYnNvY2tldC1jaGFubmVsLmpzXCJcbmltcG9ydCB7VkVMT0NJT1VTX1NZTkNfQ0hBTk5FTH0gZnJvbSBcIi4vc3luYy1jaGFubmVsLW5hbWUuanNcIlxuXG4vKiogQ29uZmlndXJhdGlvbnMgd2hvc2UgZnJhbWV3b3JrIHN5bmMgY2hhbm5lbCBoYXMgYWxyZWFkeSBiZWVuIHJlZ2lzdGVyZWQuICovXG5jb25zdCByZWdpc3RlcmVkQ29uZmlndXJhdGlvbnMgPSBuZXcgV2Vha1NldCgpXG5cbi8qKlxuICogRnJhbWV3b3JrLW93bmVkIHdlYnNvY2tldCBjaGFubmVsIGZvciBzeW5jZWQgcmVzb3VyY2VzXG4gKiAoe0BsaW5rIFZFTE9DSU9VU19TWU5DX0NIQU5ORUx9KS5cbiAqXG4gKiBTdWJzY3JpYmUgcGFyYW1zIG1pcnJvciBhIGRlY2xhcmVkIHB1bGwgc2NvcGUg4oCUIGB7cmVzb3VyY2VUeXBlLCBjb25kaXRpb25zfWBcbiAqIHBsdXMgdGhlIGNsaWVudC1pbmplY3RlZCBgYXV0aGVudGljYXRpb25Ub2tlbmAg4oCUIGFuZCBzdWJzY3JpYmUtdGltZVxuICogYXV0aG9yaXphdGlvbiBkZWxlZ2F0ZXMgdG8gdGhlIGFwcCBzeW5jIHJlc291cmNlJ3MgZXhpc3RpbmdcbiAqIGBhdXRob3JpemVDaGFuZ2VzKHtwYXJhbXMsIHNjb3BlfSlgICh0aGUgYHN5bmMuYXBpLnJlc291cmNlQ2xhc3NgKSwgc28gYXBwc1xuICogaG9vayBpbiB0aHJvdWdoIHRoZSBhdXRob3JpemF0aW9uIHRoZXkgYWxyZWFkeSBkZWNsYXJlZCBpbnN0ZWFkIG9mIHdyaXRpbmdcbiAqIHRoZWlyIG93biBjaGFubmVsIGNsYXNzZXMuIEJyb2FkY2FzdCByb3V0aW5nIG1hdGNoZXMgdGhlIHB1Ymxpc2hlcidzXG4gKiBzY29waW5nIHBhcmFtcyBhZ2FpbnN0IHRoZSBzdWJzY3JpcHRpb24ncyBzY29wZSBjb25kaXRpb25zLlxuICovXG5leHBvcnQgZGVmYXVsdCBjbGFzcyBTeW5jV2Vic29ja2V0Q2hhbm5lbCBleHRlbmRzIFZlbG9jaW91c1dlYnNvY2tldENoYW5uZWwge1xuICAvKipcbiAgICogU2NvcGUgdGhlIHN1YnNjcmlwdGlvbiB3YXMgYXV0aG9yaXplZCBmb3IsIHNldCBieSB7QGxpbmsgU3luY1dlYnNvY2tldENoYW5uZWwjY2FuU3Vic2NyaWJlfS5cbiAgICogQHR5cGUge2ltcG9ydChcIi4vc3luYy1yZXNvdXJjZS1iYXNlLmpzXCIpLlNlcmlhbGl6ZWRDaGFuZ2VzU2NvcGUgfCBudWxsfVxuICAgKi9cbiAgX3Njb3BlID0gbnVsbFxuXG4gIC8qKlxuICAgKiBSZWdpc3RlcnMgdGhlIGZyYW1ld29yayBzeW5jIGNoYW5uZWwgb24gYSBjb25maWd1cmF0aW9uIGRlY2xhcmluZyBhXG4gICAqIGBzeW5jLmFwaWAgYmxvY2sgKGd1YXJkZWQgc28gcmVwZWF0ZWQgc2VydmVyIGJvb3RzIHdpdGggdGhlIHNhbWVcbiAgICogY29uZmlndXJhdGlvbiByZWdpc3RlciBpdCBvbmx5IG9uY2UpLiBOby1vcCB3aXRob3V0IGBzeW5jLmFwaWAg4oCUIHRoZVxuICAgKiBjaGFubmVsIGF1dGhvcml6ZXMgdGhyb3VnaCB0aGUgYXBwJ3Mgc3luYyByZXNvdXJjZSBjbGFzcy5cbiAgICogQHBhcmFtIHtpbXBvcnQoXCIuLi9jb25maWd1cmF0aW9uLmpzXCIpLmRlZmF1bHR9IGNvbmZpZ3VyYXRpb24gLSBDb25maWd1cmF0aW9uIGluc3RhbmNlLlxuICAgKiBAcmV0dXJucyB7dm9pZH1cbiAgICovXG4gIHN0YXRpYyByZWdpc3RlckZyb21Db25maWd1cmF0aW9uKGNvbmZpZ3VyYXRpb24pIHtcbiAgICBpZiAoIWNvbmZpZ3VyYXRpb24uZ2V0U3luY0NvbmZpZ3VyYXRpb24oKS5hcGkgfHwgcmVnaXN0ZXJlZENvbmZpZ3VyYXRpb25zLmhhcyhjb25maWd1cmF0aW9uKSkgcmV0dXJuXG5cbiAgICByZWdpc3RlcmVkQ29uZmlndXJhdGlvbnMuYWRkKGNvbmZpZ3VyYXRpb24pXG4gICAgY29uZmlndXJhdGlvbi5yZWdpc3RlcldlYnNvY2tldENoYW5uZWwoVkVMT0NJT1VTX1NZTkNfQ0hBTk5FTCwgdGhpcylcbiAgfVxuXG4gIC8qKlxuICAgKiBBdXRob3JpemVzIHRoZSBzdWJzY3JpcHRpb24gdGhyb3VnaCB0aGUgYXBwIHN5bmMgcmVzb3VyY2U6IHRoZSBzdWJzY3JpYmVcbiAgICogcGFyYW1zIGFyZSBwYXJzZWQgaW50byB0aGUgc2FtZSBzZXJpYWxpemVkIHNjb3BlIHRoZSBjaGFuZ2VzIGVuZHBvaW50XG4gICAqIGNvbnN1bWVzIGFuZCBwYXNzZWQgdG8gdGhlIHJlc291cmNlJ3MgYGF1dGhvcml6ZUNoYW5nZXMoe3BhcmFtcywgc2NvcGV9KWAuXG4gICAqIERlbmlhbHMgYW5kIG1hbGZvcm1lZCBzY29wZXMgdGhyb3csIHJlamVjdGluZyB0aGUgc3Vic2NyaXB0aW9uLlxuICAgKiBAcmV0dXJucyB7UHJvbWlzZTxib29sZWFuPn0gV2hldGhlciB0aGUgc3Vic2NyaXB0aW9uIGlzIGFsbG93ZWQuXG4gICAqL1xuICBhc3luYyBjYW5TdWJzY3JpYmUoKSB7XG4gICAgY29uc3QgcmVzb3VyY2UgPSBhd2FpdCB0aGlzLmJ1aWxkU3luY1Jlc291cmNlKClcbiAgICBjb25zdCBzY29wZSA9IHJlc291cmNlLmNoYW5nZXNTY29wZSh7c2NvcGU6IHtjb25kaXRpb25zOiB0aGlzLnBhcmFtcy5jb25kaXRpb25zLCByZXNvdXJjZVR5cGU6IHRoaXMucGFyYW1zLnJlc291cmNlVHlwZX19KVxuXG4gICAgYXdhaXQgcmVzb3VyY2UuYXV0aG9yaXplQ2hhbmdlcyh7cGFyYW1zOiB0aGlzLnBhcmFtcywgc2NvcGV9KVxuXG4gICAgdGhpcy5fc2NvcGUgPSBzY29wZVxuXG4gICAgcmV0dXJuIHRydWVcbiAgfVxuXG4gIC8qKlxuICAgKiBCdWlsZHMgdGhlIGFwcCBzeW5jIHJlc291cmNlIGF1dGhvcml6aW5nIHRoaXMgc3Vic2NyaXB0aW9uLCBtaXJyb3JpbmcgdGhlXG4gICAqIHN5bmMgdHJhbnNwb3J0IGNvbnRyb2xsZXIncyByZXNvdXJjZSBjb25zdHJ1Y3Rpb24gd2l0aCB0aGUgYWJpbGl0eVxuICAgKiByZXNvbHZlZCBmcm9tIHRoZSBzdWJzY3JpYmUgcGFyYW1zICh3aGljaCBjYXJyeSB0aGUgY2xpZW50LWluamVjdGVkXG4gICAqIGF1dGhlbnRpY2F0aW9uVG9rZW4pLlxuICAgKiBAcmV0dXJucyB7UHJvbWlzZTxpbXBvcnQoXCIuL3N5bmMtcmVzb3VyY2UtYmFzZS5qc1wiKS5kZWZhdWx0Pn0gQXBwIHN5bmMgcmVzb3VyY2UgaW5zdGFuY2UuXG4gICAqL1xuICBhc3luYyBidWlsZFN5bmNSZXNvdXJjZSgpIHtcbiAgICBjb25zdCBjb25maWd1cmF0aW9uID0gdGhpcy5zZXNzaW9uLmNvbmZpZ3VyYXRpb25cbiAgICBjb25zdCBhcGkgPSBjb25maWd1cmF0aW9uLmdldFN5bmNDb25maWd1cmF0aW9uKCkuYXBpXG5cbiAgICBpZiAoIWFwaSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBUaGUgJHtWRUxPQ0lPVVNfU1lOQ19DSEFOTkVMfSBjaGFubmVsIHJlcXVpcmVzIGEgc3luYy5hcGkgY29uZmlndXJhdGlvbiBibG9jayB3aXRoIHRoZSBhcHAncyBzeW5jIHJlc291cmNlIGNsYXNzYClcbiAgICB9XG5cbiAgICAvLyBOYXJyb3dzIHRoZSBjb25maWd1cmVkIHJlc291cmNlIGNsYXNzIHRvIHRoZSBzeW5jIHJlc291cmNlIGNvbnRyYWN0XG4gICAgLy8gKGNoYW5nZXNTY29wZS9hdXRob3JpemVDaGFuZ2VzKSB0aGUgc3luYy5hcGkgdmFsaWRhdGlvbiByZXF1aXJlcy5cbiAgICBjb25zdCBSZXNvdXJjZUNsYXNzID0gLyoqIEB0eXBlIHt0eXBlb2YgaW1wb3J0KFwiLi9zeW5jLXJlc291cmNlLWJhc2UuanNcIikuZGVmYXVsdH0gKi8gKGFwaS5yZXNvdXJjZUNsYXNzKVxuICAgIC8vIE5hcnJvd3MgdGhlIHdlYnNvY2tldCBzdWJzY3JpYmUgcGFyYW1zIHRvIHRoZSByZXNvdXJjZSBwYXJhbXMgY29udHJhY3QuXG4gICAgY29uc3QgcGFyYW1zID0gLyoqIEB0eXBlIHtpbXBvcnQoXCIuLi9jb25maWd1cmF0aW9uLXR5cGVzLmpzXCIpLlZlbG9jaW91c1BhcmFtc30gKi8gKC8qKiBAdHlwZSB7dW5rbm93bn0gKi8gKHRoaXMucGFyYW1zKSlcbiAgICBjb25zdCByZXF1ZXN0ID0gdGhpcy5zZXNzaW9uLnVwZ3JhZGVSZXF1ZXN0XG4gICAgY29uc3QgYWJpbGl0eSA9IGF3YWl0IGNvbmZpZ3VyYXRpb24ucmVzb2x2ZUFiaWxpdHkoe3BhcmFtcywgcmVxdWVzdH0pXG5cbiAgICByZXR1cm4gbmV3IFJlc291cmNlQ2xhc3Moe1xuICAgICAgYWJpbGl0eSxcbiAgICAgIGNvbnRleHQ6IHtcbiAgICAgICAgLi4uKGFiaWxpdHk/LmdldENvbnRleHQoKSB8fCB7fSksXG4gICAgICAgIHBhcmFtcyxcbiAgICAgICAgcmVxdWVzdFxuICAgICAgfSxcbiAgICAgIGxvY2FsczogYWJpbGl0eT8uZ2V0TG9jYWxzKCkgfHwge30sXG4gICAgICBtb2RlbENsYXNzOiBSZXNvdXJjZUNsYXNzLk1vZGVsQ2xhc3MsXG4gICAgICBtb2RlbE5hbWU6IFJlc291cmNlQ2xhc3MuTW9kZWxDbGFzcz8ubmFtZSxcbiAgICAgIHBhcmFtcyxcbiAgICAgIHJlc291cmNlQ29uZmlndXJhdGlvbjogLyoqIEB0eXBlIHtpbXBvcnQoXCIuLi9jb25maWd1cmF0aW9uLXR5cGVzLmpzXCIpLkZyb250ZW5kTW9kZWxSZXNvdXJjZUNvbmZpZ3VyYXRpb259ICovICh7XG4gICAgICAgIGF0dHJpYnV0ZXM6IFJlc291cmNlQ2xhc3MuYXR0cmlidXRlcyB8fCB7fSxcbiAgICAgICAgc3luYzoge2VuYWJsZWQ6IHRydWV9XG4gICAgICB9KVxuICAgIH0pXG4gIH1cblxuICAvKipcbiAgICogUm91dGVzIGEgcHVibGlzaGVyIGJyb2FkY2FzdCB0byB0aGlzIHN1YnNjcmlwdGlvbiB3aGVuIHRoZSBwdWJsaXNoZWRcbiAgICogcmVzb3VyY2UgdHlwZSBlcXVhbHMgdGhlIHR5cGUgdGhlIHN1YnNjcmlwdGlvbiB3YXMgYXV0aG9yaXplZCBmb3IgYW5kIHRoZVxuICAgKiBzY29waW5nIHBhcmFtcyBzYXRpc2Z5IGV2ZXJ5IHNjb3BlIGNvbmRpdGlvbjogZWFjaCBjb25kaXRpb24ga2V5IG11c3QgYmVcbiAgICogcHJlc2VudCBpbiB0aGUgYnJvYWRjYXN0IHBhcmFtcyBhbmQgbWF0Y2ggYnkgc3RyaW5nIGNvbXBhcmlzb24gKGFycmF5XG4gICAqIGNvbmRpdGlvbnMgbWF0Y2ggYnkgbWVtYmVyc2hpcCkuIEJyb2FkY2FzdHMgd2l0aG91dCBhIHJlc291cmNlIHR5cGUgYW5kXG4gICAqIGNvbmRpdGlvbnMgdGhlIHB1Ymxpc2hlcidzIHNjb3BpbmcgcGFyYW1zIGRvIG5vdCBjYXJyeSBuZXZlciBtYXRjaCwgc28gYVxuICAgKiBzdWJzY3JpcHRpb24gY2Fubm90IHJlY2VpdmUgY2hhbmdlcyBvdXRzaWRlIGl0cyBhdXRob3JpemVkIHNjb3BlLlxuICAgKiBAcGFyYW0ge2ltcG9ydChcIi4uL2h0dHAtc2VydmVyL3dlYnNvY2tldC1jaGFubmVsLmpzXCIpLldlYnNvY2tldEpzb25WYWx1ZX0gYnJvYWRjYXN0UGFyYW1zIC0gUHVibGlzaGVyIHNjb3BpbmcgcGFyYW1zICh0aGUgcHVibGlzaGVkIHJlc291cmNlVHlwZSBwbHVzIHRoZSBjaGFuZ2UncyBzY29wZS1wYXJ0aXRpb24gdmFsdWVzKS5cbiAgICogQHJldHVybnMge2Jvb2xlYW59IFdoZXRoZXIgdGhlIGJyb2FkY2FzdCBiZWxvbmdzIHRvIHRoaXMgc3Vic2NyaXB0aW9uJ3Mgc2NvcGUuXG4gICAqL1xuICBtYXRjaGVzKGJyb2FkY2FzdFBhcmFtcykge1xuICAgIGNvbnN0IHNjb3BlID0gdGhpcy5fc2NvcGVcblxuICAgIGlmICghc2NvcGUpIHJldHVybiBmYWxzZVxuXG4gICAgY29uc3Qgc2NvcGluZ1BhcmFtcyA9IGJyb2FkY2FzdFBhcmFtcyAmJiB0eXBlb2YgYnJvYWRjYXN0UGFyYW1zID09PSBcIm9iamVjdFwiICYmICFBcnJheS5pc0FycmF5KGJyb2FkY2FzdFBhcmFtcylcbiAgICAgID8gLyoqIEB0eXBlIHtSZWNvcmQ8c3RyaW5nLCA/Pn0gKi8gKGJyb2FkY2FzdFBhcmFtcylcbiAgICAgIDoge31cblxuICAgIGlmICghT2JqZWN0Lmhhc093bihzY29waW5nUGFyYW1zLCBcInJlc291cmNlVHlwZVwiKSB8fCBTdHJpbmcoc2NvcGluZ1BhcmFtcy5yZXNvdXJjZVR5cGUpICE9PSBTdHJpbmcoc2NvcGUucmVzb3VyY2VUeXBlKSkgcmV0dXJuIGZhbHNlXG5cbiAgICBmb3IgKGNvbnN0IFtjb25kaXRpb25OYW1lLCBjb25kaXRpb25WYWx1ZV0gb2YgT2JqZWN0LmVudHJpZXMoc2NvcGUuY29uZGl0aW9ucykpIHtcbiAgICAgIGlmICghT2JqZWN0Lmhhc093bihzY29waW5nUGFyYW1zLCBjb25kaXRpb25OYW1lKSkgcmV0dXJuIGZhbHNlXG5cbiAgICAgIGNvbnN0IHNjb3BpbmdWYWx1ZSA9IHNjb3BpbmdQYXJhbXNbY29uZGl0aW9uTmFtZV1cblxuICAgICAgaWYgKEFycmF5LmlzQXJyYXkoY29uZGl0aW9uVmFsdWUpKSB7XG4gICAgICAgIGlmICghY29uZGl0aW9uVmFsdWUuc29tZSgodmFsdWUpID0+IFN0cmluZyh2YWx1ZSkgPT09IFN0cmluZyhzY29waW5nVmFsdWUpKSkgcmV0dXJuIGZhbHNlXG4gICAgICB9IGVsc2UgaWYgKFN0cmluZyhjb25kaXRpb25WYWx1ZSkgIT09IFN0cmluZyhzY29waW5nVmFsdWUpKSB7XG4gICAgICAgIHJldHVybiBmYWxzZVxuICAgICAgfVxuICAgIH1cblxuICAgIHJldHVybiB0cnVlXG4gIH1cblxuICAvKipcbiAgICogRGVsaXZlcnMgYSBtYXRjaGVkIGJyb2FkY2FzdC4gU2NvcGVkIHN1YnNjcmlwdGlvbnMgKHdpdGggZXhwbGljaXRcbiAgICogY29uZGl0aW9ucykgYWxyZWFkeSByb3V0ZWQgdGhyb3VnaCB7QGxpbmsgU3luY1dlYnNvY2tldENoYW5uZWwjbWF0Y2hlc30sIHNvXG4gICAqIHRoZSBjaGFuZ2UgaXMgaW4gc2NvcGUgYW5kIGRlbGl2ZXJzIHVuY2hhbmdlZC4gVXNlci1zY29wZSBzdWJzY3JpcHRpb25zXG4gICAqIChlbXB0eSBjb25kaXRpb25zLCBcImV2ZXJ5dGhpbmcgbXkgYWJpbGl0eSBjYW4gc2VlXCIpIG1hdGNoIGV2ZXJ5IGJyb2FkY2FzdFxuICAgKiBvZiB0aGUgcmVzb3VyY2UgdHlwZSwgc28gZWFjaCBwdWJsaXNoZWQgY2hhbmdlIGlzIHJlLWNoZWNrZWQgYWdhaW5zdCB0aGVcbiAgICogc3Vic2NyaWJlcidzIGFiaWxpdHkgYXQgZmFuLW91dCB0aHJvdWdoIHRoZSBhcHAgc3luYyByZXNvdXJjZSdzXG4gICAqIGBjaGFuZ2VEZWxpdmVyYWJsZWA7IG9ubHkgYWNjZXNzaWJsZSBjaGFuZ2VzIGFyZSBkZWxpdmVyZWQsIGFuZCBhIGJyb2FkY2FzdFxuICAgKiB3aXRoIG5vIGFjY2Vzc2libGUgY2hhbmdlIGlzIGRyb3BwZWQuXG4gICAqIEBwYXJhbSB7aW1wb3J0KFwiLi4vaHR0cC1zZXJ2ZXIvd2Vic29ja2V0LWNoYW5uZWwuanNcIikuV2Vic29ja2V0SnNvblZhbHVlfSBib2R5IC0gQnJvYWRjYXN0IGJvZHkgKHN5bmMgZW52ZWxvcGUpLlxuICAgKiBAcGFyYW0ge3tldmVudElkPzogc3RyaW5nfX0gW21ldGFdIC0gT3B0aW9uYWwgZXZlbnQgbWV0YWRhdGEuXG4gICAqIEByZXR1cm5zIHtQcm9taXNlPHZvaWQ+fVxuICAgKi9cbiAgYXN5bmMgZGVsaXZlckJyb2FkY2FzdChib2R5LCBtZXRhKSB7XG4gICAgaWYgKCF0aGlzLl9pc1VzZXJTY29wZSgpKSB7XG4gICAgICB0aGlzLnNlbmRNZXNzYWdlKGJvZHksIG1ldGEpXG5cbiAgICAgIHJldHVyblxuICAgIH1cblxuICAgIGNvbnN0IGRlbGl2ZXJhYmxlQm9keSA9IGF3YWl0IHRoaXMuX3VzZXJTY29wZURlbGl2ZXJhYmxlQm9keShib2R5KVxuXG4gICAgaWYgKGRlbGl2ZXJhYmxlQm9keSAhPT0gbnVsbCkgdGhpcy5zZW5kTWVzc2FnZShkZWxpdmVyYWJsZUJvZHksIG1ldGEpXG4gIH1cblxuICAvKipcbiAgICogV2hldGhlciB0aGlzIHN1YnNjcmlwdGlvbiBpcyBhIHVzZXIgc2NvcGU6IGF1dGhvcml6ZWQgd2l0aCBlbXB0eSBjb25kaXRpb25zXG4gICAqIChcImV2ZXJ5dGhpbmcgbXkgYWJpbGl0eSBjYW4gc2VlXCIpLlxuICAgKiBAcmV0dXJucyB7Ym9vbGVhbn0gV2hldGhlciB0aGUgc3Vic2NyaXB0aW9uIGlzIGEgdXNlciBzY29wZS5cbiAgICovXG4gIF9pc1VzZXJTY29wZSgpIHtcbiAgICByZXR1cm4gQm9vbGVhbih0aGlzLl9zY29wZSkgJiYgT2JqZWN0LmtleXMoLyoqIEB0eXBlIHtpbXBvcnQoXCIuL3N5bmMtcmVzb3VyY2UtYmFzZS5qc1wiKS5TZXJpYWxpemVkQ2hhbmdlc1Njb3BlfSAqLyAodGhpcy5fc2NvcGUpLmNvbmRpdGlvbnMpLmxlbmd0aCA9PT0gMFxuICB9XG5cbiAgLyoqXG4gICAqIEZpbHRlcnMgYSB1c2VyLXNjb3BlIGJyb2FkY2FzdCB0byB0aGUgc3luYyBlbnRyaWVzIHRoZSBzdWJzY3JpYmVyJ3MgYWJpbGl0eVxuICAgKiBjYW4gYWNjZXNzLCByZS1jaGVja2luZyBlYWNoIHRocm91Z2ggdGhlIGFwcCBzeW5jIHJlc291cmNlJ3NcbiAgICogYGNoYW5nZURlbGl2ZXJhYmxlYC4gUmV0dXJucyB0aGUgYnJvYWRjYXN0IG5hcnJvd2VkIHRvIGFjY2Vzc2libGUgZW50cmllcyxcbiAgICogb3IgbnVsbCB3aGVuIG5vbmUgYXJlIGFjY2Vzc2libGUuIE5vbi1lbnZlbG9wZSBib2RpZXMgYW5kIGVudHJpZXMgd2l0aG91dCBhXG4gICAqIHJlc291cmNlIGlkIGFyZSBkcm9wcGVkIChmYWlsIGNsb3NlZCkuXG4gICAqIEBwYXJhbSB7aW1wb3J0KFwiLi4vaHR0cC1zZXJ2ZXIvd2Vic29ja2V0LWNoYW5uZWwuanNcIikuV2Vic29ja2V0SnNvblZhbHVlfSBib2R5IC0gQnJvYWRjYXN0IGJvZHkuXG4gICAqIEByZXR1cm5zIHtQcm9taXNlPGltcG9ydChcIi4uL2h0dHAtc2VydmVyL3dlYnNvY2tldC1jaGFubmVsLmpzXCIpLldlYnNvY2tldEpzb25WYWx1ZSB8IG51bGw+fSBEZWxpdmVyYWJsZSBib2R5LCBvciBudWxsLlxuICAgKi9cbiAgYXN5bmMgX3VzZXJTY29wZURlbGl2ZXJhYmxlQm9keShib2R5KSB7XG4gICAgaWYgKCFib2R5IHx8IHR5cGVvZiBib2R5ICE9PSBcIm9iamVjdFwiIHx8IEFycmF5LmlzQXJyYXkoYm9keSkpIHJldHVybiBudWxsXG5cbiAgICBjb25zdCBlbnZlbG9wZSA9IC8qKiBAdHlwZSB7UmVjb3JkPHN0cmluZywgPz59ICovIChib2R5KVxuICAgIGNvbnN0IHNjb3BlID0gLyoqIEB0eXBlIHtpbXBvcnQoXCIuL3N5bmMtcmVzb3VyY2UtYmFzZS5qc1wiKS5TZXJpYWxpemVkQ2hhbmdlc1Njb3BlfSAqLyAodGhpcy5fc2NvcGUpXG4gICAgY29uc3Qgc3luY3MgPSBBcnJheS5pc0FycmF5KGVudmVsb3BlLnN5bmNzKSA/IGVudmVsb3BlLnN5bmNzIDogW2VudmVsb3BlXVxuICAgIGNvbnN0IGNvbmZpZ3VyYXRpb24gPSB0aGlzLnNlc3Npb24uY29uZmlndXJhdGlvblxuICAgIC8qKiBAdHlwZSB7QXJyYXk8UmVjb3JkPHN0cmluZywgPz4+fSAqL1xuICAgIGNvbnN0IGRlbGl2ZXJhYmxlU3luY3MgPSBbXVxuXG4gICAgLy8gQnJvYWRjYXN0IGZhbi1vdXQgcnVucyB0aHJvdWdoIGB3aXRob3V0Q3VycmVudENvbm5lY3Rpb25Db250ZXh0c2AgKHNlZVxuICAgIC8vIENvbmZpZ3VyYXRpb24jX2Jyb2FkY2FzdFRvQ2hhbm5lbExvY2FsKSwgc28gdGhlcmUgaXMgbm8gYW1iaWVudCBkYXRhYmFzZVxuICAgIC8vIGNvbm5lY3Rpb24gaGVyZS4gUmVzb2x2ZSB0aGUgcmVzb3VyY2UncyBhYmlsaXR5IGFuZCBydW4gdGhlIHBlci1kZWxpdmVyeVxuICAgIC8vIGFjY2VzcyBxdWVyeSBpbnNpZGUgYSBjaGVja2VkLW91dCBjb25uZWN0aW9uIGNvbnRleHQsIG1pcnJvcmluZyBob3cgb3RoZXJcbiAgICAvLyBicm9hZGNhc3QtdGltZSBEQiB3b3JrICh0aGUgZnJvbnRlbmQtbW9kZWwgY2hhbm5lbCkgb2J0YWlucyBjb25uZWN0aW9ucy5cbiAgICBhd2FpdCBjb25maWd1cmF0aW9uLmVuc3VyZUNvbm5lY3Rpb25zKHtuYW1lOiBgJHtWRUxPQ0lPVVNfU1lOQ19DSEFOTkVMfSB1c2VyLXNjb3BlIGRlbGl2ZXJ5IGFjY2VzcyBjaGVja2B9LCBhc3luYyAoKSA9PiB7XG4gICAgICBjb25zdCByZXNvdXJjZSA9IGF3YWl0IHRoaXMuYnVpbGRTeW5jUmVzb3VyY2UoKVxuXG4gICAgICBmb3IgKGNvbnN0IHN5bmMgb2Ygc3luY3MpIHtcbiAgICAgICAgY29uc3QgcmVzb3VyY2VJZCA9IHN5bmM/LnJlc291cmNlSWRcbiAgICAgICAgY29uc3QgcmVzb3VyY2VUeXBlID0gc3luYz8ucmVzb3VyY2VUeXBlID8/IHNjb3BlLnJlc291cmNlVHlwZVxuXG4gICAgICAgIGlmIChyZXNvdXJjZUlkID09PSB1bmRlZmluZWQgfHwgcmVzb3VyY2VJZCA9PT0gbnVsbCkgY29udGludWVcblxuICAgICAgICBpZiAoYXdhaXQgcmVzb3VyY2UuY2hhbmdlRGVsaXZlcmFibGUoe3BhcmFtczogdGhpcy5wYXJhbXMsIHNjb3BlLCBzeW5jOiB7cmVzb3VyY2VJZDogU3RyaW5nKHJlc291cmNlSWQpLCByZXNvdXJjZVR5cGU6IFN0cmluZyhyZXNvdXJjZVR5cGUpfX0pKSB7XG4gICAgICAgICAgZGVsaXZlcmFibGVTeW5jcy5wdXNoKHN5bmMpXG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9KVxuXG4gICAgaWYgKGRlbGl2ZXJhYmxlU3luY3MubGVuZ3RoID09PSAwKSByZXR1cm4gbnVsbFxuICAgIGlmIChBcnJheS5pc0FycmF5KGVudmVsb3BlLnN5bmNzKSkgcmV0dXJuIHsuLi5lbnZlbG9wZSwgc3luY3M6IGRlbGl2ZXJhYmxlU3luY3N9XG5cbiAgICByZXR1cm4gZGVsaXZlcmFibGVTeW5jc1swXVxuICB9XG5cbiAgLyoqXG4gICAqIFJldHVybnMgdGhlIGF1dGhvcml6ZWQgc2NvcGUgZm9yIGRlYnVnIHNuYXBzaG90cy5cbiAgICogQHJldHVybnMge1JlY29yZDxzdHJpbmcsID8+fSBEZWJ1Zy1zYWZlIHN1YnNjcmlwdGlvbiBkZXRhaWxzLlxuICAgKi9cbiAgZGVidWdTbmFwc2hvdCgpIHtcbiAgICByZXR1cm4ge3Njb3BlOiB0aGlzLl9zY29wZSwgdXNlclNjb3BlOiB0aGlzLl9pc1VzZXJTY29wZSgpfVxuICB9XG59XG4iXX0=

package/build/sync/query-scope.js

@@ -44,12 +44,19 @@ export function serializedScopeFromQuery(query) {
 }
 
 /**
- * Returns a stable canonical key identifying a sync scope.
+ * Returns a stable canonical key identifying a sync scope. When an `owner` is
+ * present (the authenticated identity that declared the scope locally), it
+ * participates in the key so the same wire scope owned by a different user gets
+ * its own local identity and cursor — a user scope's empty-conditions cursor
+ * never leaks across accounts on a shared device, while the same user
+ * reconnecting keeps continuity. Owner-less scopes keep their pre-owner key.
  * @param {import("./sync-client-types.js").SerializedSyncScope} scope - Serialized sync scope.
  * @returns {string} Stable scope key.
  */
 export function scopeKey(scope) {
-  return `${scope.resourceType}:${stableJsonStringify(scope.conditions)}`
+  const ownerPrefix = scope.owner === undefined || scope.owner === null ? "" : `owner=${stableJsonStringify(scope.owner)}|`
+
+  return `${ownerPrefix}${scope.resourceType}:${stableJsonStringify(scope.conditions)}`
 }
 
 /**

package/build/sync/sync-client-types.js

@@ -5,6 +5,7 @@
  * @typedef {object} SerializedSyncScope
  * @property {Record<string, ?>} conditions - Plain attribute conditions from the query.
  * @property {string} resourceType - Resource/model name the scope was declared for.
+ * @property {string} [owner] - Local partition key: the authenticated identity that declared the scope. Used only to partition the local scope/cursor store (never sent to the server as scope conditions), so a user scope's empty-conditions cursor does not leak across accounts on a shared device.
  */
 
 /**
@@ -58,6 +59,13 @@
  * @typedef {boolean | ModelSyncDeclarationConfig<TModel>} ModelSyncDeclaration
  */
 
+/**
+ * Shared app-lifetime websocket connection all sync traffic rides. Matches the
+ * realtime websocket client contract; the sync client rides it without owning
+ * its connect/disconnect lifecycle.
+ * @typedef {import("../configuration-types.js").VelociousSyncRealtimeWebsocketClient} SyncClientSharedConnection
+ */
+
 /**
  * Options for building a sync client. Everything else — resources, transport
  * POSTers, auth, connectivity, batch size — is derived from the configuration's
@@ -84,6 +92,8 @@
  * @property {import("../configuration-types.js").VelociousSyncClientRealtimeConfiguration} [realtime] - Realtime push configuration consumed by `subscribeRealtime(...)`.
  * @property {Record<string, SyncClientResourceConfig>} resources - Derived resource policies keyed by resource/model name.
  * @property {?} syncModel - Local pending-sync model class.
+ * @property {SyncClientSharedConnection} [websocketClient] - Shared app-lifetime websocket client instance (the low-level shared-connection form).
+ * @property {string | (() => string | null | undefined)} [websocketUrl] - Shared app-lifetime websocket URL the framework builds a client from.
  */
 
 export {}

package/build/sync/sync-client.js

@@ -4,6 +4,7 @@ import Configuration from "../configuration.js"
 import {isBooleanColumnType} from "../database/column-types.js"
 import Logger from "../logger.js"
 import restArgsError from "../utils/rest-args-error.js"
+import VelociousWebsocketClient from "../http-client/websocket-client.js"
 
 import {serializedScopeFromQuery} from "./query-scope.js"
 import SyncApiClient from "./sync-api-client.js"
@@ -99,11 +100,19 @@ export default class SyncClient {
       postReplay: transportPoster({path: `${clientConfiguration.mountPath}/replay`, transport: clientConfiguration.transport}),
       realtime: clientConfiguration.realtime,
       resources,
-      syncModel: resolvedSyncModel
+      syncModel: resolvedSyncModel,
+      websocketClient: clientConfiguration.websocketClient,
+      websocketUrl: clientConfiguration.websocketUrl
     }
     this._clientNumber = ++clientCounter
     /** @type {SyncRealtimeBridge | null} */
     this._realtimeBridge = null
+    /** @type {import("./sync-client-types.js").SyncClientSharedConnection | null | undefined} Shared app-lifetime websocket connection (undefined until first resolved, null when none is configured). */
+    this._syncConnection = undefined
+    /** @type {Promise<void> | null} */
+    this._subscribeUserScopePromise = null
+    /** @type {"subscribed" | "subscribing" | "unsubscribed"} */
+    this._userScopeState = "unsubscribed"
     /** @type {import("./sync-scope-store.js").default | null} */
     this._scopeStore = scopeStore || null
     /** @type {Promise<void> | null} */
@@ -449,6 +458,33 @@ export default class SyncClient {
     }
   }
 
+  /**
+   * Resolves the shared app-lifetime websocket connection all sync traffic
+   * rides, or null when none is configured. Built once and memoized (per
+   * client): an app-provided `sync.client.websocketClient` instance wins (the
+   * frontend-model transport can pass its own client so one socket carries
+   * everything), else a framework-owned reconnecting {@link VelociousWebsocketClient}
+   * built from `sync.client.websocketUrl`. The realtime bridge rides this
+   * connection without owning its lifecycle; when neither is configured the
+   * bridge falls back to the deprecated per-cycle `realtime.createClient`.
+   * @returns {import("./sync-client-types.js").SyncClientSharedConnection | null} Shared websocket connection, or null.
+   */
+  syncConnection() {
+    if (this._syncConnection !== undefined) return this._syncConnection
+
+    if (this.config.websocketClient) {
+      this._syncConnection = this.config.websocketClient
+    } else if (this.config.websocketUrl) {
+      const url = typeof this.config.websocketUrl === "function" ? this.config.websocketUrl() : this.config.websocketUrl
+
+      this._syncConnection = url ? new VelociousWebsocketClient({url}) : null
+    } else {
+      this._syncConnection = null
+    }
+
+    return this._syncConnection
+  }
+
   /**
    * Subscribes the derived realtime channels so pushed websocket changes apply
    * through the same derived applier as pulls (idempotent, single-flighted).
@@ -459,6 +495,94 @@ export default class SyncClient {
     await this.realtimeBridge().subscribe(context)
   }
 
+  /**
+   * Subscribes the server-enumerated user scope: "everything my ability can
+   * see". Declares a user scope (empty conditions) for every pullable synced
+   * resource type, subscribes realtime so their framework sync channel
+   * subscriptions go live, and pulls so the device catches up. The server
+   * authorizes each empty-conditions scope through the app sync resource's
+   * `authorizeChanges` and re-checks record access per delivery, so the client
+   * subscribes with just its token and the server decides membership.
+   * Idempotent and single-flighted like {@link SyncClient#subscribeRealtime}.
+   * @returns {Promise<void>}
+   */
+  async subscribeUserScope() {
+    if (this._userScopeState === "subscribed") return
+
+    if (!this._subscribeUserScopePromise) {
+      this._subscribeUserScopePromise = this._subscribeUserScope().finally(() => {
+        this._subscribeUserScopePromise = null
+      })
+    }
+
+    await this._subscribeUserScopePromise
+  }
+
+  /**
+   * Declares and activates the user scope for every pullable resource, then
+   * subscribes realtime and pulls.
+   * @returns {Promise<void>}
+   */
+  async _subscribeUserScope() {
+    this._userScopeState = "subscribing"
+
+    const scopeStore = this.scopeStore()
+    const owner = await this.userScopeOwner()
+
+    for (const resourceType of this.userScopeResourceTypes()) {
+      await scopeStore.findOrCreateScope({conditions: {}, owner, resourceType})
+    }
+
+    await this.subscribeRealtime()
+    await this.pull()
+
+    this._userScopeState = "subscribed"
+  }
+
+  /**
+   * Unsubscribes the user scope: deactivates the per-resource user scopes and
+   * closes the realtime channel subscriptions. The shared websocket connection
+   * stays open when one is configured (sign-out drops subscriptions without
+   * disconnecting), so a subsequent sign-in resubscribes over the same socket.
+   * @returns {Promise<void>}
+   */
+  async unsubscribeUserScope() {
+    const scopeStore = this.scopeStore()
+    const owner = await this.userScopeOwner()
+
+    for (const resourceType of this.userScopeResourceTypes()) {
+      await scopeStore.deactivate({conditions: {}, owner, resourceType})
+    }
+
+    await this.unsubscribeRealtime()
+
+    this._userScopeState = "unsubscribed"
+    this._subscribeUserScopePromise = null
+  }
+
+  /**
+   * The resource types a user scope covers: every declared resource that
+   * receives pulled changes (has pull `attributes`).
+   * @returns {string[]} Pullable resource type names.
+   */
+  userScopeResourceTypes() {
+    return Object.keys(this.pullResourceConfigs())
+  }
+
+  /**
+   * Resolves the local partition key for the user scope: the currently
+   * configured authenticated identity (the sync auth token). Partitioning the
+   * user scope's local scope/cursor rows by this owner keeps the
+   * empty-conditions cursor from leaking across accounts on a shared device
+   * (account B signing in after account A gets a fresh cursor) while the same
+   * account reconnecting keeps its cursor continuity. The owner is a local
+   * partition key only — pulls still post empty conditions to the server.
+   * @returns {Promise<string>} User-scope owner partition key.
+   */
+  async userScopeOwner() {
+    return String(await this.config.authenticationToken())
+  }
+
   /**
    * Unsubscribes the realtime channels and disconnects the websocket client (idempotent).
    * @returns {Promise<void>}

package/build/sync/sync-realtime-bridge.js

@@ -30,6 +30,8 @@ export default class SyncRealtimeBridge {
     this._channels = []
     /** @type {VelociousSyncRealtimeWebsocketClient | null} */
     this._client = null
+    /** @type {boolean} Whether the bridge created its own client (deprecated per-cycle path) and must disconnect it on unsubscribe. A shared connection is never owned. */
+    this._ownsClient = false
     /** @type {Promise<void>} */
     this._applyPromise = Promise.resolve()
     /** @type {number} Subscription generation - bumped by unsubscribe so in-flight subscribes detect they became stale. */
@@ -80,8 +82,13 @@ export default class SyncRealtimeBridge {
     const channels = []
     /** @type {VelociousSyncRealtimeWebsocketClient | null} */
     let client = null
+    /** @type {boolean} Whether this attempt created its own client and must disconnect it on teardown. */
+    let ownsClient = false
     /**
-     * Tears down everything this stale/failed subscribe attempt created itself.
+     * Tears down everything this stale/failed subscribe attempt created itself:
+     * always closes its channel subscriptions, and disconnects the websocket
+     * only when the bridge owns it (deprecated per-cycle path); a shared
+     * connection stays open.
      * @returns {Promise<void>}
      */
     const teardown = async () => {
@@ -89,18 +96,28 @@ export default class SyncRealtimeBridge {
         subscription.close()
       }
 
-      if (client) await client.disconnectAndStopReconnect()
+      if (client && ownsClient) await client.disconnectAndStopReconnect()
     }
 
     try {
-      const realtime = this.realtimeConfiguration()
+      const sharedClient = this.syncClient.syncConnection()
+      const realtime = this.requireClientSource(sharedClient)
       const channelDescriptors = await this.channelDescriptors(context)
 
       if (generation !== this._generation) return
 
-      client = await realtime.createClient()
+      if (sharedClient) {
+        client = sharedClient
+      } else {
+        // requireClientSource guaranteed realtime.createClient when there is no shared connection.
+        client = await /** @type {import("../configuration-types.js").VelociousSyncClientRealtimeConfiguration} */ (realtime).createClient()
+        ownsClient = true
+      }
 
-      if (generation !== this._generation) return
+      if (generation !== this._generation) {
+        await teardown()
+        return
+      }
 
       await client.connect()
 
@@ -140,6 +157,7 @@ export default class SyncRealtimeBridge {
 
       this._channels = channels
       this._client = client
+      this._ownsClient = ownsClient
       this._state = "subscribed"
       this.schedulePull()
     } catch (error) {
@@ -152,9 +170,12 @@ export default class SyncRealtimeBridge {
   }
 
   /**
-   * Closes every channel subscription and disconnects the websocket client
-   * (idempotent). Also marks any in-flight subscribe attempt stale so it tears
-   * itself down instead of finishing the subscription afterwards.
+   * Closes every channel subscription (idempotent). The websocket is
+   * disconnected only when the bridge owns it (deprecated per-cycle
+   * `realtime.createClient` path); a shared app-lifetime connection stays open
+   * so unsubscribing drops subscriptions without tearing down the socket. Also
+   * marks any in-flight subscribe attempt stale so it tears itself down instead
+   * of finishing the subscription afterwards.
    * @returns {Promise<void>}
    */
   async unsubscribe() {
@@ -162,16 +183,18 @@ export default class SyncRealtimeBridge {
 
     const channels = this._channels
     const client = this._client
+    const ownsClient = this._ownsClient
 
     this._channels = []
     this._client = null
+    this._ownsClient = false
     this._state = "unsubscribed"
 
     for (const {subscription} of channels) {
       subscription.close()
     }
 
-    if (client) await client.disconnectAndStopReconnect()
+    if (client && ownsClient) await client.disconnectAndStopReconnect()
   }
 
   /**
@@ -195,14 +218,26 @@ export default class SyncRealtimeBridge {
   }
 
   /**
-   * Resolves the realtime configuration, failing loudly when it is missing.
-   * @returns {import("../configuration-types.js").VelociousSyncClientRealtimeConfiguration} Realtime configuration.
+   * Resolves the realtime configuration block, or null when the app declared
+   * none (valid when a shared connection is configured).
+   * @returns {import("../configuration-types.js").VelociousSyncClientRealtimeConfiguration | null} Realtime configuration, or null.
    */
   realtimeConfiguration() {
-    const realtime = this.syncClient.config.realtime
+    return this.syncClient.config.realtime || null
+  }
+
+  /**
+   * Resolves the realtime configuration and asserts a websocket client source
+   * exists: a shared connection rides its own lifecycle, otherwise the
+   * deprecated per-cycle `realtime.createClient` must be configured.
+   * @param {import("../configuration-types.js").VelociousSyncRealtimeWebsocketClient | null} sharedClient - Shared connection, or null.
+   * @returns {import("../configuration-types.js").VelociousSyncClientRealtimeConfiguration | null} Realtime configuration, or null.
+   */
+  requireClientSource(sharedClient) {
+    const realtime = this.realtimeConfiguration()
 
-    if (!realtime) {
-      throw new Error("subscribeRealtime requires a sync.client.realtime configuration block with a createClient callback")
+    if (!sharedClient && typeof realtime?.createClient !== "function") {
+      throw new Error("subscribeRealtime requires a shared connection (sync.client.websocketUrl or sync.client.websocketClient) or the deprecated sync.client.realtime.createClient callback")
     }
 
     return realtime
@@ -235,7 +270,7 @@ export default class SyncRealtimeBridge {
       channelDescriptors.push({channel: resourceConfig.realtime.channel, params: resourceConfig.realtime.params, resourceType})
     }
 
-    if (realtime.channels) {
+    if (realtime?.channels) {
       channelDescriptors.push(...await realtime.channels(context))
     }
 
@@ -306,7 +341,7 @@ export default class SyncRealtimeBridge {
 
     const realtime = this.realtimeConfiguration()
 
-    if (realtime.localOrigin && body.echoOrigin !== undefined && body.echoOrigin !== null) {
+    if (realtime?.localOrigin && body.echoOrigin !== undefined && body.echoOrigin !== null) {
       const localOrigin = String(await realtime.localOrigin())
 
       if (String(body.echoOrigin) === localOrigin) return
@@ -329,7 +364,7 @@ export default class SyncRealtimeBridge {
    * @returns {void}
    */
   schedulePull() {
-    if (this.realtimeConfiguration().pullOnReconnect === false) return
+    if (this.realtimeConfiguration()?.pullOnReconnect === false) return
 
     this._scheduledPull ||= (async () => {
       try {

package/build/sync/sync-resource-base.js

@@ -215,6 +215,27 @@ export default class SyncResourceBase extends FrontendModelBaseResource {
     throw new Error("SyncResourceBase#scopeChangesQuery must be implemented")
   }
 
+  /**
+   * Decides whether one published change is deliverable to a user-scope
+   * subscription (the framework sync channel's per-delivery access re-check).
+   * The default reuses the app's ability scoping: it applies
+   * {@link SyncResourceBase#scopeChangesQuery} to the change-feed model — which
+   * for an empty-conditions user scope falls back to ability scoping — and
+   * checks whether the published change's feed row is visible within that
+   * scope. Apps get this for free from the scoping they already declared;
+   * override only for custom per-delivery rules.
+   * @param {{params: Record<string, ?>, scope: SerializedChangesScope | null, sync: {resourceId: string, resourceType: string}}} args - Request params, subscription scope, and the published change's identity.
+   * @returns {Promise<boolean>} Whether the change may be delivered to this subscription.
+   */
+  async changeDeliverable({params, scope, sync}) {
+    const query = this.syncModelClass().where({})
+
+    this.scopeChangesQuery({params, query, scope})
+    query.where({resource_id: String(sync.resourceId), resource_type: String(sync.resourceType)})
+
+    return Boolean(await query.first())
+  }
+
   /**
    * Resolves the replay service class handling replay mutations: the
    * declarative {@link SyncResourceBase.ReplayServiceClass} static (shared

package/build/sync/sync-websocket-channel.js

@@ -136,11 +136,90 @@ export default class SyncWebsocketChannel extends VelociousWebsocketChannel {
     return true
   }
 
+  /**
+   * Delivers a matched broadcast. Scoped subscriptions (with explicit
+   * conditions) already routed through {@link SyncWebsocketChannel#matches}, so
+   * the change is in scope and delivers unchanged. User-scope subscriptions
+   * (empty conditions, "everything my ability can see") match every broadcast
+   * of the resource type, so each published change is re-checked against the
+   * subscriber's ability at fan-out through the app sync resource's
+   * `changeDeliverable`; only accessible changes are delivered, and a broadcast
+   * with no accessible change is dropped.
+   * @param {import("../http-server/websocket-channel.js").WebsocketJsonValue} body - Broadcast body (sync envelope).
+   * @param {{eventId?: string}} [meta] - Optional event metadata.
+   * @returns {Promise<void>}
+   */
+  async deliverBroadcast(body, meta) {
+    if (!this._isUserScope()) {
+      this.sendMessage(body, meta)
+
+      return
+    }
+
+    const deliverableBody = await this._userScopeDeliverableBody(body)
+
+    if (deliverableBody !== null) this.sendMessage(deliverableBody, meta)
+  }
+
+  /**
+   * Whether this subscription is a user scope: authorized with empty conditions
+   * ("everything my ability can see").
+   * @returns {boolean} Whether the subscription is a user scope.
+   */
+  _isUserScope() {
+    return Boolean(this._scope) && Object.keys(/** @type {import("./sync-resource-base.js").SerializedChangesScope} */ (this._scope).conditions).length === 0
+  }
+
+  /**
+   * Filters a user-scope broadcast to the sync entries the subscriber's ability
+   * can access, re-checking each through the app sync resource's
+   * `changeDeliverable`. Returns the broadcast narrowed to accessible entries,
+   * or null when none are accessible. Non-envelope bodies and entries without a
+   * resource id are dropped (fail closed).
+   * @param {import("../http-server/websocket-channel.js").WebsocketJsonValue} body - Broadcast body.
+   * @returns {Promise<import("../http-server/websocket-channel.js").WebsocketJsonValue | null>} Deliverable body, or null.
+   */
+  async _userScopeDeliverableBody(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) return null
+
+    const envelope = /** @type {Record<string, ?>} */ (body)
+    const scope = /** @type {import("./sync-resource-base.js").SerializedChangesScope} */ (this._scope)
+    const syncs = Array.isArray(envelope.syncs) ? envelope.syncs : [envelope]
+    const configuration = this.session.configuration
+    /** @type {Array<Record<string, ?>>} */
+    const deliverableSyncs = []
+
+    // Broadcast fan-out runs through `withoutCurrentConnectionContexts` (see
+    // Configuration#_broadcastToChannelLocal), so there is no ambient database
+    // connection here. Resolve the resource's ability and run the per-delivery
+    // access query inside a checked-out connection context, mirroring how other
+    // broadcast-time DB work (the frontend-model channel) obtains connections.
+    await configuration.ensureConnections({name: `${VELOCIOUS_SYNC_CHANNEL} user-scope delivery access check`}, async () => {
+      const resource = await this.buildSyncResource()
+
+      for (const sync of syncs) {
+        const resourceId = sync?.resourceId
+        const resourceType = sync?.resourceType ?? scope.resourceType
+
+        if (resourceId === undefined || resourceId === null) continue
+
+        if (await resource.changeDeliverable({params: this.params, scope, sync: {resourceId: String(resourceId), resourceType: String(resourceType)}})) {
+          deliverableSyncs.push(sync)
+        }
+      }
+    })
+
+    if (deliverableSyncs.length === 0) return null
+    if (Array.isArray(envelope.syncs)) return {...envelope, syncs: deliverableSyncs}
+
+    return deliverableSyncs[0]
+  }
+
   /**
    * Returns the authorized scope for debug snapshots.
    * @returns {Record<string, ?>} Debug-safe subscription details.
    */
   debugSnapshot() {
-    return {scope: this._scope}
+    return {scope: this._scope, userScope: this._isUserScope()}
   }
 }

package/package.json

@@ -3,7 +3,7 @@
     "velocious": "build/bin/velocious.js"
   },
   "name": "velocious",
-  "version": "1.0.504",
+  "version": "1.0.506",
   "main": "build/index.js",
   "types": "build/index.d.ts",
   "files": [